On the 24th of August 2001, a fully loaded Airbus A330 on a transatlantic flight from Toronto to Lisbon ran out of fuel over the middle of the ocean, forcing the pilots to attempt a harrowing 121-kilometer glide to a remote island airfield. And yet, with no fuel, no engines, minimal braking power, and only a single chance to get it right, the pilots pulled off the seemingly impossible — they brought Air Transat flight 236 to a safe landing in the Azores, after what would prove to be the longest powerless glide ever accomplished in a commercial aircraft. For a few brief days, the pilots became extraordinary heroes; and the flight itself, the Miracle on the Hudson of its time. And then reality came crashing down.
Investigators would soon uncover a chain of decisions, both on the ground and in the air, which brought flight 236 to the brink of disaster. The story involved mismatched parts during an engine replacement; a massive fuel leak over the ocean in the middle of the night; and an inability on the part of the pilots to identify the problem — a lapse which led them to feed all their fuel straight into the leak until it was gone. The incident would ultimately reveal that pilots around the world were unprepared to deal with fuel leaks, and that the design of numerous airplanes, including the A330, actively hindered crews’ ability to respond. These discoveries would cast the miracle of flight 236 in a new light — but would also tangibly improve safety for passengers everywhere.
◊◊◊
Founded in 1986, Air Transat is the third largest airline in Canada, with over 30 aircraft and more than 60 destinations. The airline does not fly domestically, specializing instead in scheduled and charter flights from Canada to popular holiday destinations abroad, switching regularly between southern locales in winter and Europe during the summer. Although the airline previously operated some Boeing and Lockheed aircraft, today it has an all Airbus fleet.
Since the late 1990s, the star of Air Transat’s long haul fleet has been the Airbus A330, a long-range, wide body, twin-engine jet which first entered service in 1994. Equipped with the latest in fly-by-wire technology, flight envelope protections, and computerized flight monitoring systems, the plane was considered state-of-the-art, and by 2001 it had yet to experience a serious accident or incident in passenger service — a fatal crash during flight testing in 1994 notwithstanding.
It was one of these A330s which was scheduled to carry out a regular overnight flight from Toronto, Canada to Lisbon, Portugal, on the 23rd and 24th of August 2001. But the story of that flight begins not on the runway in Toronto, but at Air Transat’s maintenance base at Mirabel Airport in Montreal, approximately one week before the dramatic emergency in the Azores.
On August 17th, this same airplane, registration C-GITS, was taken in for maintenance after built-in sensors twice detected the presence of metal chips in the engine oil on the right engine. Chips in the oil typically appear when a component is experiencing abnormal wear, but after inspecting the engine, technicians were unable to locate the source of the issue. It was decided that the engine should be replaced with a spare, allowing the plane to remain in service while Air Transat’s maintenance department conducted a more in-depth examination.
Airlines normally keep spare engines on hand for precisely this sort of scenario, but the preceding summer Air Transat had found itself without one for its A330 fleet. As a result, Rolls Royce loaned the airline a spare Trent 772B-60 engine of the type used on the A330 and sent it to Mirabel from an overhaul facility in Hong Kong, where it arrived in July 2000. Because the engine was the only spare Trent 772B in North America at that time, it was kept secure and intact, ready for transfer to any airline that needed it on short notice. It just so happened that Air Transat would be the first to find itself in need.
The timeline for the replacement, established on August 17th, promised to be tight. Work commenced at midnight that same day, giving workers just 48 hours — all of Saturday the 18th and Sunday the 19th — to get the plane ready for its next scheduled flight on Monday the 20th. During those 48 hours, they would need to disconnect the original engine, gather all required parts, maneuver the replacement engine into position, hook up numerous systems, install all the accessories, test the functionality of the engine, and carry out an inspection. If any of these steps took longer than expected, the next flight might have to be delayed.
Everything initially went smoothly, as the original engine was removed and stripped of any accessories which would be needed to install the new engine. Per the standard arrangement, the loaner engine from Rolls Royce came with what is known as a “carry forward list” — a list of components to be retained by the airline in order to facilitate the installation of the engine. Between those components which were already on the airplane and those kept as spare parts, Air Transat was confident that they had all the items on the carry forward list, and the installation of the new engine proceeded as planned on Sunday morning.
One of the “carry forward” items not included with the engine itself was the rear hydraulic pump. The list indicated that the engine required a hydraulic pump with part number 946976, which was the same part installed on all of Air Transat’s A330s, so the technicians decided to simply use the hydraulic pump from the old engine. Or at least, that was the plan — in fact, when they attempted to install the pump on the new engine, they were puzzled to find that it didn’t fit. It was impossible to wedge it in place because several fuel feed pipes were trying to occupy the same space at the same time. In search of a solution to this mystifying development, the technicians dived into the Airbus Illustrated Parts Catalogue, where they quickly discovered the source of the problem.
◊◊◊
In 1999, Airbus received multiple reports of minor hydraulic fluid leakages at the rear hydraulic pumps on Airbus A330s with Trent 772B engines. In response to the reports, Airbus issued a non-mandatory service bulletin, or SB, providing operators with instructions for replacing the hydraulic pumps with any of three newer versions that would be less susceptible to leakage. Recognizing that the new hydraulic pumps had wider housings which would interfere with surrounding Rolls Royce-manufactured fuel lines, that company also issued service bulletin calling for the replacement of the fuel lines with new versions that wouldn’t come into contact with the hydraulic pumps. Both service bulletins stated that if one was to be carried out, the other must performed as well.
Because they were not seen as safety critical and were not backed up by an airworthiness directive from any regulatory authority, the service bulletins were purely optional. However, most airlines, in practice, accomplish every service bulletin whether it is required or not, and so by the time Air Transat acquired its A330s, the aircraft had had both of these service bulletins already embodied.
The loaner engine, on the other hand, had a different history. While being overhauled in July 2000, the repair shop, known as Hong Kong Aero Engine Services Limited, or HAESL, planned to carry out the Rolls Royce service bulletin on this engine, but abandoned the plan after failing to acquire the necessary parts in a timely manner. The engine was thus sent to Air Transat without the Rolls Royce service bulletin having been embodied. Furthermore, HAESL was only required to inform Air Transat about optional SBs that it had completed, not those which were still outstanding. Therefore, in order to discover the discrepancy, Air Transat personnel would have had to cross check all 167 optional service bulletins listed in the engine’s history against those embodied on the rest of the company’s engines, which was not normally done because it would take too much time.
As a result, no one was aware that the loaner engine was different until the technicians consulted the parts catalogue and realized that the fuel pipes installed on the engine corresponded to the pre-SB configuration, making them incompatible with the post-SB hydraulic pump. In order to find out what parts were actually needed, the lead technician attempted to use a computer to read a CD containing the text of the service bulletins, but due to a network error, he was denied access. The Rolls Royce SBs were also listed in the Trent Illustrated Parts Catalogue, accessible from any computer at the facility, but he was apparently unaware of this, so he instead switched to plan B and called the Air Transat Maintenance Control Center for help.
Maintenance Control patched the lead technician through to the local expert on Trent engines, known as the Engine Controller. The Engine Controller readily recalled the relevant service bulletins, although he did not have copies on hand, and informed the lead technician that they would need to replace the fuel lines in the engine with post-SB versions, which could be taken from the engine that was being removed. The lead technician asked if they could use a pre-SB hydraulic pump instead, but the Engine Controller pointed out that every Trent 772 engine in Canada had already been modified except for this one, so it would be impossible to find a pre-mod hydraulic pump. The decision was therefore made to replace the fuel lines, effectively bringing the engine into compliance with the SBs. The fact that the technicians did not have access to the text of the SBs was briefly mentioned, but the issue was quickly subordinated to concerns about the timeline.
Shortly thereafter, the technicians replaced the pre-SB fuel lines with post-SB versions and installed the post-SB hydraulic pump. This time, it went in without too much trouble. But if they had looked at the text of the SB, they would have realized that they missed a step: they were also supposed to replace the hydraulic tube which attached to the pump.
Although it was possible to install the post-SB fuel lines and hydraulic pump with a pre-SB hydraulic tube, the tube would rest against one of the fuel lines at a point where it rounded a 90-degree bend close to the pump. Aware that the plane could not be dispatched unless there was clearance between the tubes, the technicians torqued a nut on the end of the hydraulic tube until it rose approximately 0.635 mm off the face of the fuel line. They did not appear to appreciate the fact that this clearance was insufficient for a flexible tube that would change shape when pumped full of pressurized hydraulic fluid.
After the last of the accessories were installed, the technicians carried out a successful runup, and an inspector verified the continuity of the engine controls. The exact part numbers of random hydraulic tubes and the clearances between them were not part of the normal inspection regime, and the tiny mistake went unnoticed. The paperwork was then signed, the aircraft was released for service, and the technicians went home late on Sunday night, pleased that they had accomplished the work on time.
◊◊◊
Four days later, on the night of August 23rd, the crew of Air Transat flight 236 reported for duty at Toronto Pearson International Airport in order to fly C-GITS over to Lisbon. In command was 48-year-old Captain Robert Piché, a larger-than-life figure who got his wings as a bush pilot in the hinterlands of northern Quebec. His unusual resume also included a stint as an aerial drug smuggler, which saw him serve 16 months in a US prison after he was caught using his plane to transport marijuana into the country. The conviction didn’t stop Air Transat from hiring him in 1995, however, and he was considered sufficiently “reformed” by 2000 that he was officially pardoned. That night, he was joined by a much less experienced First Officer, 28-year-old Dirk DeJager, who had 4,800 hours of flying time to Piché’s 16,800. The flight also featured a full complement of 11 flight attendants and 293 passengers, totaling 306 people on board.
After topping up the plane’s two wing tanks for a total fuel load of 46.9 metric tons — 5.5 tons more than required for the journey — Piché and DeJager performed an uneventful takeoff from Toronto, and flight 236 was airborne at 19:52 local time, 42 minutes behind schedule. The flight climbed progressively to its cruising altitude of 39,000 feet, heading east across the Maritime provinces of Canada, before proceeding out over the vast Atlantic Ocean that gave the airline its name.
For four hours, all seemed to be normal. Neither pilot could possibly have been aware that deep inside the right engine, the seeds of disaster sown days earlier by the maintenance team were about to bear fruit.
When hydraulic fluid first
